P3.1: Detector — oauth_flow scaffold and registration

[bjcorder]

Parent tracker: #62
Spec: docs/superpowers/specs/2026-05-21-edge-case-hardening-design.md
Milestone: P3

Goal

Create the new oauth_flow detector and register it. The detector recognises OAuth/OIDC authorization-code flow construction across the supported libraries so P3.2–P3.5 classifier rules can flag PKCE / state / nonce / redirect_uri risks.

Acceptance criteria

• New module crates/sessionscope-detectors/src/oauth_flow/mod.rs.
• Detector registered in crates/sessionscope-detectors/src/registry.rs.
• Recognises auth-code flow construction in:
  • passport-oauth2 strategy configuration
  • openid-client Issuer.discover / client.authorizationUrl calls
  • next-auth provider blocks (OAuthProvider, OIDCProvider)
  • authlib OAuth2Client, OAuth2Session, OAuth registry
  • Generic crypto-near-identifier patterns: crypto.randomBytes(...) / secrets.token_urlsafe(...) near identifiers named state, nonce, code_verifier, code_challenge.
• Emits artifact type for the auth-code flow.
• Audit whether to add a new artifact type oauth_auth_code_flow or reuse an existing one (e.g., session_record or opaque_bearer_token) — flag for the consolidated P4.8 audit if a new artifact type is required.
• All evidence excerpts pass through redaction (P3.9 adds OAuth-specific redaction patterns).

Files touched

• crates/sessionscope-detectors/src/oauth_flow/mod.rs (new)
• crates/sessionscope-detectors/src/registry.rs (register)
• crates/sessionscope-model/src/artifact.rs (conditional — only if new artifact type lands)

Audit-then-decide

• Artifact-type decision flagged for the consolidated P4.8 audit.
• No new finding category from this issue — findings land in P3.2–P3.5.

Doc-update checklist

• docs/USAGE.md notes the new detector under a new "OAuth/OIDC flow" subsection.
• Coverage-matrix entries deferred until P3.2–P3.5 land findings.

[bjcorder]

Implemented in 8d16ee3.

Summary:

• Added and registered the oauth_flow detector for source-visible OAuth/OIDC authorization-code flow construction.
• Added the audited oauth_auth_code_flow artifact type because existing token/session artifact types do not accurately model authorization-code flow construction and callback verification evidence.
• Emits evidence for flow construction, PKCE, state, OIDC nonce, redirect URI literals/broad redirects, framework defaults, and callback verification signals with sanitized excerpts.
• Updated schema/usage docs and artifact type display helpers for the new artifact type.

Validation:

• cargo test -q -p sessionscope-detectors oauth_flow — passed
• cargo check --workspace — passed

Notes / follow-ups:

• Follow-on classifiers for PKCE/state/nonce/redirect risk land in P3.2: Classifier — PKCE missing on auth-code flow #78, P3.3: Classifier — OAuth state parameter integrity #79, P3.4: Classifier — OIDC nonce missing / unverified #80, and P3.5: Classifier — wildcard redirect_uri matching #81.

[bjcorder]

Implemented in review-fix commit 4814668.

Summary:

• Scoped OAuth flow artifacts/evidence by auth-code construction line to avoid one complete flow suppressing findings for a separate incomplete flow in the same file.
• Narrowed state/nonce verification evidence to actual comparisons or verification helper calls rather than plain reads.
• Added detector regression tests for separate flows and read-without-compare behavior.
• Also redacted literal second arguments for token-shaped browser storage calls to preserve the redaction boundary.

Validation:

• cargo test -q -p sessionscope-detectors oauth_flow — passed
• cargo test -q -p sessionscope-detectors client_storage — passed
• cargo test -q -p sessionscope-testing p3_ — passed

Notes / follow-ups:

• None.

[bjcorder]

Implemented in review-fix commit a69a59f.

Summary:

• Further bounded OAuth evidence to the current auth-code construction segment instead of proximity to adjacent flow constructors.
• Avoided creating flow artifacts from import-only lines and inert client constructors.
• Extended OAuth redaction to template-literal state/nonce/PKCE values.
• Extended browser storage redaction to template-literal token values.

Validation:

• cargo test -q -p sessionscope-detectors oauth_flow — passed
• cargo test -q -p sessionscope-detectors client_storage — passed
• cargo test -q -p sessionscope-testing p3_ — passed

Notes / follow-ups:

• None.

[bjcorder]

Implemented in review-fix commit b1ddd2a.

Summary:

• Removed pre-flow evidence attachment so preceding PKCE/state/nonce lines cannot suppress findings for a later OAuth flow.
• Tightened state/nonce verification regexes to expected/session/cookie/cache or recognized verifier call shapes.
• Added report-level browser storage setItem redaction for token-shaped keys, including template literals.
• Added reporter/core regression coverage for browser storage value redaction.

Validation:

• cargo test -q -p sessionscope-detectors oauth_flow — passed
• cargo test -q -p sessionscope-detectors client_storage — passed
• cargo test -q -p sessionscope-core redacts_browser_storage_token_values — passed
• cargo test -q -p sessionscope-reporters render_sanitizes_browser_storage_token_values — passed
• cargo test -q -p sessionscope-testing p3_ — passed

Notes / follow-ups:

• None.

[bjcorder]

Implemented in review-fix commit 180b44e.

Summary:

• Preserved pre-flow PKCE/state/nonce evidence within the current flow segment while still preventing evidence before a previous flow from suppressing findings for a later flow.

Validation:

• cargo test -q -p sessionscope-detectors oauth_flow — passed
• cargo test -q -p sessionscope-testing p3_ — passed

Notes / follow-ups:

• None.

[bjcorder]

Implemented in PR #98: #98

Implementation commits:

• 8d16ee3 — P3.1 oauth_flow scaffold and registration
• 4814668 — Review fix: OAuth flow scoping and redaction
• a69a59f — Review fix: tighter redaction and flow bounds
• b1ddd2a — Review fix: focused P3 blockers
• 180b44e — Review fix: preserve pre-flow OAuth evidence

Validation:

• cargo fmt --all -- --check — passed
• cargo check --workspace — passed
• cargo test -q — passed
• cargo clippy --workspace --all-targets -- -D warnings — passed

Closure status:

• This issue is ready to close when the PR is merged.

Remaining notes:

• P3.1 artifact-type audit outcome adds oauth_auth_code_flow; include in P4.8 audit rollup.